/**
 * k8s-bootstrap.ts — apply the `olam` namespace + RBAC + secret set on a
 * fresh kubernetes cluster.
 *
 * B4 of olam-issue-npm-only-k3s. Without this an npm-only operator running
 * `olam upgrade --substrate=kubernetes` against a fresh cluster fails with:
 *
 *   Error from server (NotFound): namespaces "olam" not found
 *   Secret "olam-host-cp-secret" not found in namespace "olam"
 *
 * The 8-step upgrade flow (upgrade-kubernetes.ts) already runs
 * `seedManifestsFromBundle` to put manifest YAML at ~/.olam/k8s/manifests/,
 * but no one APPLIES them on first install — operators were expected to
 * `kubectl apply -f` by hand. That barrier is the npm-only blocker this
 * module closes.
 *
 * Idempotency: kubectl apply is idempotent by design for manifests
 * (server-side merge keys deduplicate). For secrets we render once and
 * persist the values to ~/.olam/k8s-secrets-state.json — subsequent runs
 * reuse the same values so worlds that have cached tokens don't break.
 *
 * Order (matches the seed manifest filename numeric prefix):
 *   1. 00-namespace.yaml        — host-cp namespace
 *   2. 10-serviceaccount.yaml   — host-cp ServiceAccount
 *   3. 20-rbac.yaml             — host-cp Role/RoleBinding
 *   4. 30-configmap.yaml        — host-cp env ConfigMap
 *   5. 45-pvc.yaml              — host-cp PersistentVolumeClaim
 *   6. host-cp Secret           — RENDERED from templates/40-secret-template.yaml
 *   7. per-peripheral manifests + secrets (auth-service, mcp-auth-service, kg-service, memory-service)
 *
 * Deployments + Services (50-deployment.yaml, 60-service.yaml) are NOT
 * applied here — that is upgrade-kubernetes.ts's job (it manages rollout
 * status + port-forward + audit log). ensureK8sBootstrap returns once the
 * "prerequisites" (namespace + RBAC + secrets) are in place.
 */
import { kubectlWrap } from './kubectl-wrap.js';
import { type RenderDeps, type RenderResult } from './k8s-secret-render.js';
export declare const K8S_NAMESPACE = "olam";
/**
 * kubectl apply wrapper — accepts a YAML string and applies via stdin (D20
 * stdin-safe; values never inlined into argv). When `manifestPath` is given
 * the file is applied via `-f <path>` instead (manifests stay on disk).
 */
declare function kubectlApply(context: string, source: {
    path: string;
} | {
    stdinYaml: string;
}, deps: BootstrapDeps): Promise<{
    ok: boolean;
    stderr: string;
}>;
/**
 * Locate the bundled k8s assets directory. In install-mode this is
 * `<install-root>/host-cp/k8s/`. In dev-mode it falls back to the
 * monorepo's `packages/host-cp/k8s/`.
 */
export declare function resolveK8sAssetsRoot(installRootDir?: string): string | null;
export interface BootstrapDeps {
    /** Injectable kubectlWrap for tests. */
    readonly kubectlWrapImpl?: typeof kubectlWrap;
    /** Override the k8s assets root path (auto-resolved via installRoot when absent). */
    readonly k8sAssetsRoot?: string;
    /** Pass-through deps for the secret renderer (file IO, gh-token, RNG, state file). */
    readonly renderDeps?: RenderDeps;
    /** stdout for human-readable progress. */
    readonly stdout?: NodeJS.WritableStream;
    /** stderr for warnings + errors. */
    readonly stderr?: NodeJS.WritableStream;
    /** Hook into kubectlApply for tests (overrides the kubectlWrap path entirely). */
    readonly applyImpl?: typeof kubectlApply;
}
export interface BootstrapOptions {
    readonly context: string;
    readonly namespace?: string;
    /** When true, regenerate every secret value (overwrites ~/.olam/k8s-secrets-state.json). */
    readonly rotateSecrets?: boolean;
    /** When true, no kubectl invocations happen; the function returns the would-be plan. */
    readonly dryRun?: boolean;
}
export type AppliedKind = {
    kind: 'manifest';
    path: string;
} | {
    kind: 'secret';
    name: string;
};
export interface BootstrapResult {
    readonly applied: ReadonlyArray<AppliedKind>;
    readonly skipped: ReadonlyArray<{
        kind: AppliedKind['kind'];
        ref: string;
        reason: string;
    }>;
    readonly secretResults: ReadonlyArray<RenderResult>;
}
/**
 * Run the bootstrap. Idempotent on re-run.
 *
 * Apply order (numeric filename prefix mirrors apply ORDER):
 *   1. <root>/manifests/00-namespace.yaml + 10/20/30/45 (host-cp prereqs)
 *   2. Per-peripheral 10/20/30/45 prereqs (auth-service / mcp-auth-service / kg-service / memory-service)
 *   3. host-cp Secret (rendered from templates/40-secret-template.yaml)
 *   4. Per-peripheral Secrets (rendered from each *-secret-template.yaml)
 *
 * On the first failed apply we surface the kubectl stderr and stop —
 * partial-apply state is left in the cluster (kubectl apply is idempotent;
 * re-running picks up where we stopped).
 */
export declare function ensureK8sBootstrap(opts: BootstrapOptions, deps?: BootstrapDeps): Promise<{
    exitCode: number;
    result: BootstrapResult;
    error?: string;
}>;
/**
 * Read the list of expected Secret names — used by probeK8sRequiredSecrets
 * so the doctor probe stays in lockstep with the bootstrap module.
 */
export declare function expectedSecretNames(): ReadonlyArray<string>;
export {};
//# sourceMappingURL=k8s-bootstrap.d.ts.map